CVE-2026-27628

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27628
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4d
https://github.com/py-pdf/pypdf/issues/3654 Issue Tracking Patch
https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35 Patch Vendor Advisory
https://github.com/py-pdf/pypdf/issues/3654 Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*
History

27 Feb 2026, 20:21

Type Values Removed Values Added
References
  • {'url': 'https://github.com/py-pdf/pypdf/commit/0fbd95938724ad2d72688d4112207c0590f0483f', 'tags': ['Patch'], 'source': 'security-advisories@github.com'}
  • () https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4d -

25 Feb 2026, 17:25

Type Values Removed Values Added
References () https://github.com/py-pdf/pypdf/issues/3654 - Issue Tracking, Patch () https://github.com/py-pdf/pypdf/issues/3654 - Issue Tracking, Patch

25 Feb 2026, 16:09

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*
First Time Pypdf Project
Pypdf Project pypdf
References () https://github.com/py-pdf/pypdf/commit/0fbd95938724ad2d72688d4112207c0590f0483f - () https://github.com/py-pdf/pypdf/commit/0fbd95938724ad2d72688d4112207c0590f0483f - Patch
References () https://github.com/py-pdf/pypdf/issues/3654 - () https://github.com/py-pdf/pypdf/issues/3654 - Issue Tracking, Patch
References () https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35 - () https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35 - Patch, Vendor Advisory

25 Feb 2026, 03:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-25 03:16

Updated : 2026-02-27 20:21

NVD link : CVE-2026-27628

Mitre link : CVE-2026-27628

CVE.ORG link : CVE-2026-27628

JSON object : View

Products Affected

pypdf_project

  • pypdf
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')